iloveeyjafjalla opened a new issue, #6864:
URL: https://github.com/apache/rocketmq-dashboard/issues/6864
## Summary
The Settings → AI assistant tab offers **保存**, **测试连接** and **清除密钥** to
every role, while the endpoints behind them are admin-only: a non-admin
(reader) click is answered with `403` and an error toast. The sibling 常规设置 tab
of the same page already disables exactly these kinds of controls for readers.
## Why
- The LLM configuration surface is admin-only on both ends.
`AuthInterceptor` requires admin for every POST that is not in
`READER_POST_PATHS` (logout/password/metrics) —
`server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java:45-49`,
`:149` — and `GET /api/llm/config` is an admin-only read as well. The tab's
own load path states it: "The endpoint is admin-only, so a reader always ends
up here" (`web/src/pages/settings/AiAssistantTab.tsx:169-172`).
- The AI tab derives no role at all (no `useAuthStore` in the file) and its
three write controls are gated by `loading` only: save (`:557`), test
connection (`:562`), clear key (`:447`).
- The general settings tab, whose writes are equally admin-only, carries the
guard for exactly this reason: `canWriteSettings = !authUserId || authAdmin ===
true` (`GeneralSettingsTab.tsx:80`) drives `disabled` on its buttons and an
early return in each write handler. The AI tab was left out.
## Impact
A reader is shown an enabled form and controls that can only fail: every
save, test and key-clear round-trips to a 403 plus an error toast. The two tabs
of one page disagree about who may write, so the same user is stopped in one
and invited in the other.
## Reproduction
`web/src/pages/settings/__tests__/AiAssistantTabReader.test.tsx` → `disables
the admin-only save and test controls for readers` renders the tab with `{
admin: false, userId: 42 }` and the load failing the way it does for a reader.
Before the fix both buttons are enabled:
```
Error: expect(element).toBeDisabled()
```
## Expected
Save, test connection and clear key are disabled for a reader and their
handlers return early, while an admin's stay enabled — pinned by the second
case (`keeps the save and test controls usable for an admin`) of the same file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
